@fitlab-ai/agent-infra 0.11.13 → 0.11.14

package/lib/task/lifecycle.ts

@@ -106,6 +106,8 @@ type LifecycleFileSystem = {
 };
 type TaskLifecycleOptions = {
   repoRoot?: string;
+  controlRoot?: string;
+  controlProject?: string;
   metadataProvider?: () => TaskWriteMetadata;
   fileSystem?: Partial<LifecycleFileSystem>;
   taskFileSystem?: Partial<TaskFileSystem>;
@@ -276,6 +278,105 @@ function transferTaskContents(sourcePath: string, targetPath: string): void {
   }
 }
 
+function pathExists(candidate: string): boolean {
+  try { fs.lstatSync(candidate); return true; }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+function assertTaskControlRootPath(controlRoot: string, taskId: string, expectedProject?: string): void {
+  if (path.basename(controlRoot) !== taskId || path.basename(path.dirname(controlRoot)) !== 'tasks'
+    || (expectedProject !== undefined && path.basename(path.dirname(path.dirname(controlRoot))) !== expectedProject)) {
+    throw new Error('control root path does not match the task/project layout');
+  }
+  const managedBase = path.dirname(path.dirname(path.dirname(controlRoot)));
+  let current = managedBase;
+  for (const segment of path.relative(managedBase, controlRoot).split(path.sep).filter(Boolean)) {
+    const stat = fs.lstatSync(current);
+    if (stat.isSymbolicLink()) throw new Error('control root ancestor is a symbolic link');
+    current = path.join(current, segment);
+  }
+  const stat = fs.lstatSync(controlRoot);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('control root is not a real directory');
+}
+
+function assertTaskControlManifestIdentity(controlRoot: string, taskId: string, repoRoot: string, expectedProject?: string): void {
+  const controlManifest = path.join(controlRoot, 'manifest.json');
+  if (!fs.existsSync(controlManifest)) throw new Error('control manifest is missing');
+  const manifestStat = fs.lstatSync(controlManifest);
+  if (!manifestStat.isFile() || manifestStat.isSymbolicLink()) throw new Error('control manifest is not a real file');
+  const manifest = JSON.parse(fs.readFileSync(controlManifest, 'utf8')) as {
+    mode?: unknown; taskId?: unknown; project?: unknown; repoRoot?: unknown;
+  };
+  const project = expectedProject ?? path.basename(path.dirname(path.dirname(controlRoot)));
+  if (manifest.mode !== 'task-bound' || manifest.taskId !== taskId || manifest.project !== project
+    || typeof manifest.repoRoot !== 'string' || fs.realpathSync.native(manifest.repoRoot) !== fs.realpathSync.native(repoRoot)) {
+    throw new Error('control manifest identity does not match the task');
+  }
+}
+
+function taskBoundControlMoveSafety(
+  request: TaskLifecycleRequest,
+  controlRoot: string | undefined,
+  options: TaskLifecycleOptions,
+  taskId: string,
+  repoRoot: string,
+  validateManifestIdentity: boolean
+): LifecycleError | null {
+  if (!controlRoot) return null;
+  const controlManifest = path.join(controlRoot, 'manifest.json');
+  const controlLease = path.join(controlRoot, 'lease.json');
+  const stateExists = pathExists(controlRoot) || pathExists(controlManifest) || pathExists(controlLease);
+  if (stateExists) {
+    try {
+      assertTaskControlRootPath(controlRoot, taskId, options.controlProject);
+      if (validateManifestIdentity) {
+        assertTaskControlManifestIdentity(controlRoot, taskId, repoRoot, options.controlProject);
+      } else {
+        const manifestStat = fs.lstatSync(controlManifest);
+        if (!manifestStat.isFile() || manifestStat.isSymbolicLink()) throw new Error('control manifest is not a real file');
+      }
+    }
+    catch {
+      return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task-bound sandbox control root is missing, malformed, or belongs to another task' };
+    }
+  }
+  if (request.intent !== 'complete' && (pathExists(controlManifest) || pathExists(controlLease))) {
+    return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task-bound sandbox control state exists; stop and remove the verified sandbox before moving the task directory' };
+  }
+  return null;
+}
+
+function orchestrationMoveSafety(sourcePath: string): LifecycleError | null {
+  const orchestrationPath = path.join(sourcePath, '.runtime', 'orchestration.json');
+  if (!pathExists(orchestrationPath)) return null;
+  try {
+    const run = JSON.parse(fs.readFileSync(orchestrationPath, 'utf8')) as { status?: unknown; pendingDelegation?: unknown };
+    if (run.status === 'running' || run.pendingDelegation !== null && run.pendingDelegation !== undefined) {
+      return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task orchestration has an active or pending delegation; settle it before moving the task directory' };
+    }
+  } catch {
+    return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task orchestration state is unreadable; refusing to move the task directory' };
+  }
+  return null;
+}
+
+function runtimeMoveSafety(
+  request: TaskLifecycleRequest,
+  movingTaskDirectory: boolean,
+  options: TaskLifecycleOptions,
+  taskId: string,
+  repoRoot: string,
+  sourcePath: string,
+  validateControlManifestIdentity: boolean
+): LifecycleError | null {
+  if (!movingTaskDirectory) return null;
+  const controlSafety = taskBoundControlMoveSafety(request, options.controlRoot, options, taskId, repoRoot, validateControlManifestIdentity);
+  return controlSafety ?? orchestrationMoveSafety(sourcePath);
+}
+
 function targetContainsTask(targetPath: string, taskId: string, request: TaskLifecycleRequest): boolean {
   try {
     const stat = fs.lstatSync(targetPath);
@@ -554,35 +655,6 @@ function applyTaskLifecycleUnlocked(requestInput: TaskLifecycleRequest, options:
   const targetPath = path.join(repoRoot, '.agents', 'workspace', spec.target, taskId);
   const requiredSteps = stepsForIntent(request.intent);
   const movingTaskDirectory = sourcePath !== targetPath;
-  const assertRuntimeMoveSafe = (): LifecycleError | null => {
-    if (!movingTaskDirectory) return null;
-    const controlManifest = path.join(sourcePath, '.runtime', 'sandbox-control', 'manifest.json');
-    const controlLease = path.join(sourcePath, '.runtime', 'sandbox-control', 'lease.json');
-    if (request.intent !== 'complete' && (fs.existsSync(controlManifest) || fs.existsSync(controlLease))) {
-      return {
-        code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE',
-        message: 'task-bound sandbox control state exists; stop and remove the verified sandbox before moving the task directory'
-      };
-    }
-    const orchestrationPath = path.join(sourcePath, '.runtime', 'orchestration.json');
-    if (fs.existsSync(orchestrationPath)) {
-      try {
-        const run = JSON.parse(fs.readFileSync(orchestrationPath, 'utf8')) as { status?: unknown; pendingDelegation?: unknown };
-        if (run.status === 'running' || run.pendingDelegation !== null && run.pendingDelegation !== undefined) {
-          return {
-            code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE',
-            message: 'task orchestration has an active or pending delegation; settle it before moving the task directory'
-          };
-        }
-      } catch {
-        return {
-          code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE',
-          message: 'task orchestration state is unreadable; refusing to move the task directory'
-        };
-      }
-    }
-    return null;
-  };
   const currentTaskFile = path.join(sourcePath, 'task.md');
   const existingJournal = fs.existsSync(path.join(sourcePath, '.task-lifecycle.json'));
   if (sourceState === spec.target && !existingJournal) {
@@ -605,7 +677,7 @@ function applyTaskLifecycleUnlocked(requestInput: TaskLifecycleRequest, options:
     && !(request.intent === 'complete' && targetContainsTask(targetPath, taskId, request))) {
     return failed(request, { code: 'LIFECYCLE_TARGET_CONFLICT', message: `target directory already exists: ${targetPath}` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
   }
-  const moveSafety = assertRuntimeMoveSafe();
+  const moveSafety = runtimeMoveSafety(request, movingTaskDirectory, options, taskId, repoRoot, sourcePath, true);
   if (moveSafety) return failed(request, moveSafety, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
   const content = io.readFileSync(currentTaskFile);
   let frontmatter;
@@ -732,7 +804,7 @@ function applyTaskLifecycleUnlocked(requestInput: TaskLifecycleRequest, options:
   }
   if (fs.existsSync(targetPath) && !fs.existsSync(path.join(sourcePath, 'task.md'))) completed.add('directory-moved');
   if (!completed.has('directory-moved')) {
-    const moveSafety = assertRuntimeMoveSafe();
+    const moveSafety = runtimeMoveSafety(request, movingTaskDirectory, options, taskId, repoRoot, sourcePath, false);
     if (moveSafety) return failed(request, moveSafety, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, completedSteps: [...completed], changed: completed.size > 0, timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
     fs.mkdirSync(path.dirname(targetPath), { recursive: true });
     if (request.intent === 'complete') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.11.13",
+  "version": "0.11.14",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Antigravity CLI, and OpenCode",
   "license": "MIT",
   "type": "module",

package/templates/.agents/rules/lifecycle-orchestration.en.md

@@ -15,7 +15,6 @@
 ## Current Host
 
 - Use native spawn, wait, and App Server results from the current host. A task-bound sandbox executes ordinary task orchestration locally in the current worktree.
-- Codex controller `open`, `verify`, and `close` remain restricted broker operations. After `open`, complete typed `verify` with the same lease proof before accepting the task, control-generation, and controller-instance binding.
 - Prepare validates the current task, model policy, and host preflight. Start and terminal records associate observed parent/child identity; failure must not be recorded as success.
 - Client-specific preflight, event sources, and stop-evidence validation belong to the client adapter. The common orchestrator calls only the shared capability and contains no client-ID branches.
 
@@ -28,9 +27,9 @@
 
 ## Current-only Cutover and Rollback
 
-- Enter a quiet window before cutover: let in-flight orchestration intents return, stop the wrapper/controller, and preserve the worktree, task/run/orchestration state, receipts, registration, and audit. For an unknown result, inspect local `status`/`route` before using existing recover/advance semantics; do not replay an old broker request.
-- Deploy or roll back the CLI, broker, controller adapter, and protocol as one versioned unit. After stopping the old container/broker, rebuild and run `ai sandbox start --recreate <task-ref>` to resume with a new control generation; never reuse an old token, proof, or request.
-- On either the new or rolled-back version, first confirm the same task through `status`/`route`, then require a successful typed controller `open`→`verify`. Keep the quiet window and evidence intact if any check fails; do not mix component versions or rewrite domain facts.
+- Enter a quiet window before cutover: let in-flight orchestration intents return and preserve the worktree, task/run/orchestration state, receipts, and audit. For an unknown result, inspect local `status`/`route` before using existing recover/advance semantics; do not replay an old broker request.
+- Deploy or roll back the CLI, broker, and protocol as one versioned unit. After stopping the old container/broker, rebuild and run `ai sandbox start --recreate <task-ref>` to resume with a new control generation; never reuse an old token or request.
+- On either the new or rolled-back version, first confirm the same task through `status`/`route`. Keep the quiet window and evidence intact if any check fails; do not mix component versions or rewrite domain facts.
 
 ## Model Policy
 

package/templates/.agents/rules/lifecycle-orchestration.zh-CN.md

@@ -15,7 +15,6 @@
 ## 当前宿主
 
 - 使用当前宿主的原生 spawn、wait 与 App Server 结果；task-bound sandbox 在当前 worktree 本地执行普通任务编排。
-- Codex controller 的 `open`、`verify`、`close` 继续通过受限 broker 执行。`open` 后必须用同一 lease proof 完成 typed `verify`，再接受 task、control generation 和 controller instance 绑定。
 - prepare 校验当前任务、模型策略与宿主 preflight。启动和完成记录关联实际 parent/child 身份，失败不得写成成功。
 - 客户端特有的 preflight、事件来源与停止证据校验由客户端适配器实现；公共总控只调用统一能力。不得在公共流程中新增客户端 ID 分支。
 
@@ -28,9 +27,9 @@
 
 ## Current-only 切换与回滚
 
-- 切换前进入静默窗口：等待在途编排 intent 返回，停止 wrapper/controller，并保留 worktree、task/run/orchestration 状态、receipts、registration 与 audit。结果未知时先用本地 `status`/`route` 判断 domain 是否已提交，再按现有 recover/advance 语义处理；旧 broker request 不重放。
-- CLI、broker、controller adapter 和协议必须作为同一版本单元部署或回退。停止旧 container/broker 后执行 rebuild 与 `ai sandbox start --recreate <task-ref>`，以新 control generation 恢复执行；旧 token、proof 和 request 不得复用。
-- 新版本或回退版本都必须先核对同一任务的 `status`/`route`，再要求 controller typed `open`→`verify` 成功。任一检查失败时继续保持静默并保留证据，不局部混用组件或改写 domain 事实。
+- 切换前进入静默窗口：等待在途编排 intent 返回，并保留 worktree、task/run/orchestration 状态、receipts 与 audit。结果未知时先用本地 `status`/`route` 判断 domain 是否已提交，再按现有 recover/advance 语义处理；不重放旧 broker request。
+- CLI、broker 与协议必须作为同一版本单元部署或回退。停止旧 container/broker 后执行 rebuild 与 `ai sandbox start --recreate <task-ref>`，以新的 control generation 恢复执行；旧 token 和 request 不得复用。
+- 新版本或回滚版本都必须先核对同一任务的 `status`/`route`。任一检查失败时继续保持静默并保留证据，不局部混用组件或改写 domain 事实。
 
 ## 模型策略
 

package/templates/.agents/rules/task-short-id.en.md

@@ -24,12 +24,13 @@ Task short ids let mobile-style SKILL invocations replace the full 22-char
 |------------|-----------------------------------------------------------------------|---------------------------------------------------------------|
 | alloc      | `create-task`, `import-issue`, `import-codescan`, `import-dependabot` | Assigns lowest free `NN` in the registry.                    |
 | resolve    | Lifecycle SKILLs (`analyze-task`, `plan-task`, `code-task`, …)        | Looks up `NN` → full task id. Does not allocate.             |
-| release    | `complete-task`, `cancel-task`, `block-task`, `close-codescan`, `close-dependabot` | Removes the registry entry. |
+| release    | Successful sandbox cleanup; also `cancel-task`, `block-task`, `close-codescan`, and `close-dependabot` | Removes the registry entry. |
 | re-alloc   | `restore-task`                                                        | Re-allocates a (possibly new) `NN` in the registry. |
 
-Short ids are valid only while a task lives in `.agents/workspace/active/`.
-Once it is moved to `completed/`, `blocked/`, or `archive/`, the `NN` slot is
-freed and may be reused by a new task.
+Completion retains the short id so a sandbox still associated with the
+completed task can resolve it before cleanup. The id is released only after
+managed sandbox cleanup confirms that the container was deleted successfully.
+Other lifecycle intents release ids at the times listed in the table.
 
 ## Configuration
 
@@ -52,10 +53,13 @@ archiving all active tasks first (the registry key width depends on it).
 | Entrypoint                                                  | Hit                  | Miss                                                 |
 |-------------------------------------------------------------|----------------------|------------------------------------------------------|
 | SKILL parameter resolver (lifecycle SKILLs)                  | resolve to full id   | **strict error** — short id not found / invalid     |
-| `ai sandbox exec <N>` / `ai sandbox create <N>`           | resolve to full id, then read `branch` from task.md | **strict error** — no ls-index fallback, no literal-branch fallback; hint the user to pass a short id / `TASK-id` / branch name |
+| `ai sandbox exec <N>` / `ai sandbox create <N>`           | resolve to an active task id, then read `branch` from task.md | **strict error** — no ls-index fallback, no literal-branch fallback; hint the user to pass a short id / `TASK-id` / branch name |
+| `ai sandbox rm <N>`                                       | resolve the retained mapping, then read active or completed identity by full task id | **strict error** — stop cleanup when the short id is missing |
 
-`list --verify` is strictly read-only: it reports discrepancies between the
-active dir and the registry, but never writes.
+`list --verify` is strictly read-only: every active task must have a mapping;
+registry mappings may point to a valid active task or to a
+`completed/{taskId}/task.md` whose identity matches and whose status is
+`completed`. Other mappings are reported as orphans; no state is modified.
 
 ## SKILL parameter resolver
 
@@ -94,11 +98,13 @@ Short ids are pure local state, persisted only in the registry
 - Created on demand by the first `alloc`; an absent file is treated as an empty
   registry.
 - Short ids are assigned only by an explicit `alloc` (`create-task` /
-  `import-*` / `restore-task`); `resolve` / `list` / `release` never allocate —
-  they only clean up stale entries pointing at non-active tasks.
-- After archive (complete-task / cancel-task / block-task / close-*) the
-  registry entry is deleted immediately and the short id may be reused; archived
-  tasks are referenced by their full `TASK-…` id.
+  `import-*` / `restore-task`); `resolve` and `list` are read-only and do not
+  perform implicit cleanup.
+- `alloc` may clean up stale entries that point neither to an active task nor
+  to valid completed task content. Completed mappings stay until managed
+  sandbox cleanup succeeds.
+- Task operations may resolve a completed mapping and then reject it at their
+  own state gate; `ai sandbox create <N>` still accepts active tasks only.
 
 `resolve(<N>)` workflow: ① validate arg matches `^[0-9]+$` →
 ② strip leading zeros and take the numeric value `n`; classify as reserved

package/templates/.agents/rules/task-short-id.zh-CN.md

@@ -19,11 +19,12 @@
 |-----------|---------------------------------------------------------------------------------------------|------------------------------------------------------------------|
 | alloc     | `create-task`、`import-issue`、`import-codescan`、`import-dependabot`                       | 分配最小可用 `NN`，写入注册表。                                  |
 | resolve   | 生命周期 SKILL（`analyze-task` / `plan-task` / `code-task` / `review-*` / `commit` / …）    | `NN` → 完整 task id 查询，不分配。                              |
-| release   | `complete-task`、`cancel-task`、`block-task`、`close-codescan`、`close-dependabot`          | 从注册表移除。                                                   |
+| release   | sandbox cleanup 成功；以及 `cancel-task`、`block-task`、`close-codescan`、`close-dependabot` | 从注册表移除。                                                   |
 | re-alloc  | `restore-task`                                                                              | 重新分配（可能与历史不同），写入注册表。                         |
 
-短号仅在任务处于 `.agents/workspace/active/` 期间有效；任务移动到
-`completed/` / `blocked/` / `archive/` 后短号立即释放，可被新任务复用。
+complete 保留短号，供 completed task 与仍关联的 sandbox 在 cleanup 前继续解析。
+受管 sandbox cleanup 确认容器已删除且清理成功后，才释放对应 completed task 的短号。
+其他 lifecycle intent 继续按表中时机释放短号。
 
 ## 配置
 
@@ -45,9 +46,12 @@
 | 入口                                                       | 注册表命中            | 注册表未命中                                            |
 |-----------------------------------------------------------|----------------------|--------------------------------------------------------|
 | SKILL 入参解析器（生命周期 SKILL）                          | 解析为完整 task id    | **严格报错** —— 短号不存在 / 格式错误                  |
-| `ai sandbox exec <N>` / `ai sandbox create <N>`           | 解析为完整 task id 后查 task.md 取 `branch` | **严格报错** —— 不再回退到 ls 行号或字面分支名；提示用任务短号 / `TASK-id` / 分支名 |
+| `ai sandbox exec <N>` / `ai sandbox create <N>`           | 解析为 active task id 后查 task.md 取 `branch` | **严格报错** —— 不再回退到 ls 行号或字面分支名；提示用任务短号 / `TASK-id` / 分支名 |
+| `ai sandbox rm <N>`                                       | 解析保留映射，再按完整 task id 读取 active 或 completed 身份 | **严格报错** —— 短号不存在时停止清理 |
 
-`list --verify` 严格只读：报告 active 目录 / 注册表 两者差异，但不修改任何状态。
+`list --verify` 严格只读：active task 必须有映射；注册表映射可指向有效 active task
+或 `completed/{taskId}/task.md` 中身份匹配且状态为 completed 的 task。其他映射作为 orphan
+报告，不修改任何状态。
 
 ## SKILL 入参解析
 
@@ -78,8 +82,9 @@ fi
 - key 是零填充到 `task.shortIdLength` 位的字符串，value 是完整 `TASK-…` task id
 - 自动 git ignore（active 工作区整体 ignore；无需新增 ignore 条目）
 - 首次 `alloc` 时按需自动创建；不存在时按空注册表处理
-- 短号只由显式 `alloc`（`create-task` / `import-*` / `restore-task`）分配；`resolve` / `list` / `release` 不分配，仅在执行时自动清理指向非 active 任务的 stale entry
-- 归档（complete-task / cancel-task / block-task / close-*）后注册表 entry 立即删除，短号可被新任务复用；归档后引用任务一律用完整 `TASK-…` id
+- 短号只由显式 `alloc`（`create-task` / `import-*` / `restore-task`）分配；`resolve` 与 `list` 只读，不做隐式清理
+- alloc 可清理既非 active、也没有有效 completed task 内容的 stale entry；completed mapping 保留至受管 sandbox cleanup 成功
+- task 操作可按 completed mapping 解析后由各自状态门禁拒绝；`ai sandbox create <N>` 仍只接受 active task
 
 `resolve(<N>)` 工作流：① 校验入参匹配 `^[0-9]+$` → ② 去前导零取
 数值 `n`，按 `n` 是否 `== 0`（保留）/ `> 10^shortIdLength - 1`（超容量）/

package/templates/.agents/skills/create-release-note/SKILL.en.md

@@ -63,6 +63,8 @@ agent-infra-internal platform-release-notes context \
 
 Use `pullRequests` and `commits` from Step 3. Each commit's `authors` contains only that commit's platform authors; `pullRequestNumbers` records the platform's PR associations. The skill does not interpret raw platform fields or email rules. A PR's `closingIssues` contains its actual closing Issues; never infer a relationship from matching PR and Issue numbers.
 
+Release notes describe changes actually delivered between the tags. For commits without an associated PR, inspect the actual diff using the `oid` from the typed context to determine whether it records a delivered change or release workflow mechanics. A commit made up only of version metadata updates, generated release artifacts, or other mechanical release preparation/publication work is outside the release's change set and contributor counts. When a commit also contains an independent product, documentation, or maintenance change, retain that change and its authors. If the diff does not establish the commit's purpose, keep it and describe the actual change. Use this same filtered commit set for the classification in Step 6 and contributor counts in Step 7.
+
 ### 5. Collect Related Issues
 
 Use each PR's `closingIssues` from Step 3. Do not parse platform-specific reference syntax in this generic skill.
@@ -112,7 +114,7 @@ If no historical release notes exist, use the following default Markdown format:
 5. **Contributor collection**:
    - **Data sources**:
      - PR authors from the typed context
-     - Commit co-authors from the typed context's commit `authors`
+     - Commit co-authors from `authors` of commits retained as release changes in Step 4
      - Issue reporters from typed `closingIssues[].author`
    - **Contribution count**: `PR count + co-authored commit count` for the same identity, merged across both sources
    - **`@login` mapping**: follow the identity safety boundary in `.agents/rules/release-commands.md`

package/templates/.agents/skills/create-release-note/SKILL.zh-CN.md

@@ -63,6 +63,8 @@ agent-infra-internal platform-release-notes context \
 
 使用步骤 3 返回的 `pullRequests` 与 `commits`。每个 commit 的 `authors` 只包含该 commit 的平台作者；`pullRequestNumbers` 表示平台记录的 PR 关联。技能不读取平台原始字段或邮箱规则。PR 的 `closingIssues` 是该 PR 实际关闭的 Issue，不按 PR/Issue 编号推断关联。
 
+发布说明记录标签间实际交付的变更。对于没有关联 PR 的 commit，依据 typed context 中的 `oid` 检查实际 diff，判断它记录的是版本交付还是发布流程本身。仅包含版本元数据更新、生成发布产物或其他版本准备/发布机械操作的 commit 不属于本版本变更，也不计入贡献者；同一 commit 若还包含独立的产品、文档或维护改动，则保留这些改动及其作者。diff 无法说明提交用途时，保留该 commit，并根据实际改动描述。步骤 6 的变更分类和步骤 7 的贡献者统计使用同一筛选结果。
+
 ### 5. 收集关联 Issue
 
 使用步骤 3 中每个 PR 的 `closingIssues`，不在通用技能中解析平台专有引用语法。
@@ -112,7 +114,7 @@ agent-infra-internal platform-release-notes context \
 5. **贡献者搜集**：
    - **数据源**：
      - PR author：来自 `.agents/rules/release-commands.md` 中已合并 PR 查询规则
-     - Commit co-authors：来自步骤 3 typed context 的 commit `authors`
+     - Commit co-authors：来自步骤 3 typed context 中按步骤 4 纳入版本变更的 commit `authors`
      - Issue reporters：来自步骤 3 typed context 的 `closingIssues[].author`
    - **贡献数定义**：`该人的 PR 数 + 该人作为 co-author 的 commit 数`（同一身份跨来源合并计数）
    - **`@login` 映射**：遵循 `.agents/rules/release-commands.md` 的身份安全边界

package/templates/.agents/skills/run-task/SKILL.en.md

@@ -14,7 +14,7 @@ The entry point may omit the task ref; explicit task scope accepts only `--task
 The orchestrator delegates only and never executes a stage skill itself. First read `.agents/rules/no-mid-flow-questions.md`, `.agents/rules/lifecycle-orchestration.md`, and `reference/host-validation.md`.
 
 1. Resolve the canonical task ID, current Agent Client, and optional atomic policy flags, then run `task-snapshot`. If one explicit role field is present, all four are required.
-2. Use the current host's native child spawn, wait, and result interfaces. Task-bound sandboxes execute ordinary task orchestration locally in the current worktree; Codex controller `open`, `verify`, and `close` remain restricted broker operations. Retain task binding and checks for real external process operations.
+2. Use the current host's native child spawn, wait, and result interfaces. Task-bound sandboxes execute ordinary task orchestration locally in the current worktree. Retain task binding and checks for real external process operations.
 3. Before each loop, run `agent-infra-internal task-lifecycle {task-id} recover-started --agent {client} --auto`. The client adapter owns recovery capability and stop-evidence validation; an unsupported adapter or a run that needs no recovery returns `no-op`. Continue only after `no-op` or `applied`. Stop on every other result; a later operator invocation retries from persisted state without routing or dispatching a child.
 4. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing runs use persisted policy. Disk state outside the complete current structure fails closed without rewriting; finish or clear active runs before upgrading. Stop on paused/completed results.
 5. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text`, present its summary per `.agents/rules/validation-output.md` while retaining necessary diagnostics, and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.

package/templates/.agents/skills/run-task/SKILL.zh-CN.md

@@ -14,7 +14,7 @@ description: >
 总控只编排，不直接执行任何阶段技能。执行前先读取 `.agents/rules/no-mid-flow-questions.md`、`.agents/rules/lifecycle-orchestration.md` 与 `reference/host-validation.md`。
 
 1. 解析规范任务 ID、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
-2. 使用当前宿主的原生子 Agent 启动、等待与结果接口。task-bound sandbox 在当前 worktree 本地执行普通任务编排；Codex controller 的 `open`、`verify`、`close` 继续通过受限 broker 执行。保留任务绑定与真实外部进程操作检查。
+2. 使用当前宿主的原生子 Agent 启动、等待与结果接口。task-bound sandbox 在当前 worktree 本地执行普通任务编排。保留任务绑定与真实外部进程操作检查。
 3. 每次进入循环时先调用 `agent-infra-internal task-lifecycle {task-id} recover-started --agent {client} --auto`。客户端适配器负责恢复能力和停止证据校验；没有该能力或无需恢复时返回 `no-op`。仅在结构化结果为 `no-op` 或 `applied` 时继续，其他结果安全停止；下一次人为调用按持久化状态幂等重试，不 route、不派发 child。
 4. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；existing run 使用持久化策略。磁盘状态不符合当前完整结构时核心失败关闭且不改写；升级前必须完成或清空 active run。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
 5. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；按 `.agents/rules/validation-output.md` 展示摘要并保留必要诊断。仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。

package/dist/lib/agent-clients/adapters/codex-lifecycle/controller-client.js

@@ -1,130 +0,0 @@
-import { SandboxControlClientError, requestSandboxAgentOperation } from '../../../sandbox/control/client.js';
-function fail(code, message, accepted = true) {
-    throw new SandboxControlClientError({ code, message: `${code}: ${message}`, retryable: false }, accepted);
-}
-function exactKeys(value, keys) {
-    return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
-}
-function validProcess(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const process = value;
-    return exactKeys(process, ['pid', 'startTime'])
-        && Number.isSafeInteger(process.pid) && process.pid > 0
-        && Number.isSafeInteger(process.startTime) && process.startTime >= 0;
-}
-function validBuild(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const build = value;
-    return exactKeys(build, ['internalExecutableBuildHash', 'lifecycleContractHash', 'packageVersion', 'protocolVersion'])
-        && build.protocolVersion === 3
-        && typeof build.packageVersion === 'string' && build.packageVersion.length > 0
-        && typeof build.internalExecutableBuildHash === 'string' && /^[a-f0-9]{64}$/u.test(build.internalExecutableBuildHash)
-        && typeof build.lifecycleContractHash === 'string' && /^[a-f0-9]{64}$/u.test(build.lifecycleContractHash);
-}
-function parseCodexControllerResult(response) {
-    if (response.phase !== 'completed' || response.error !== null || response.stderr !== '') {
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result outer response is invalid');
-    }
-    let value;
-    try {
-        if (!response.stdout.endsWith('\n') || response.stdout.slice(0, -1).includes('\n'))
-            throw new Error('not canonical');
-        value = JSON.parse(response.stdout);
-    }
-    catch {
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result payload is invalid');
-    }
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result payload is invalid');
-    }
-    const result = value;
-    const keys = result.status === 'verified'
-        ? ['binding', 'changed', 'error', 'lease', 'status', 'version']
-        : ['changed', 'error', 'lease', 'status', 'version'];
-    if (!exactKeys(result, keys) || result.version !== 1
-        || !['opened', 'closed', 'failed', 'verified'].includes(result.status)) {
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result schema is invalid');
-    }
-    if (result.status === 'failed') {
-        const error = result.error;
-        if (response.exitCode !== 1 || result.changed !== false || result.lease !== null || !error
-            || !exactKeys(error, ['code', 'message', 'retryable'])
-            || typeof error.code !== 'string' || !/^[A-Z][A-Z0-9_]+$/u.test(error.code)
-            || typeof error.message !== 'string' || error.retryable !== false) {
-            fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller failure result is invalid');
-        }
-        fail(error.code, error.message);
-    }
-    if (response.exitCode !== 0 || result.error !== null) {
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller success result is invalid');
-    }
-    if (result.status === 'closed') {
-        if (typeof result.changed !== 'boolean' || result.lease !== null)
-            fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller close result is invalid');
-        return result;
-    }
-    if (result.status === 'verified') {
-        const binding = result.binding;
-        if (result.changed !== false || result.lease !== null || !binding
-            || !exactKeys(binding, ['controllerInstanceDigest', 'controlGeneration', 'taskId'])
-            || typeof binding.taskId !== 'string' || binding.taskId.length === 0
-            || typeof binding.controlGeneration !== 'string' || binding.controlGeneration.length === 0
-            || typeof binding.controllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(binding.controllerInstanceDigest)) {
-            fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller verify result is invalid');
-        }
-        return result;
-    }
-    const lease = result.lease;
-    if (result.changed !== true || !lease
-        || !exactKeys(lease, ['buildIdentity', 'controlGeneration', 'controllerInstanceDigest', 'controllerProcess', 'expiresAt', 'issuedAt', 'leaseId', 'leaseSecret', 'taskId', 'version'])
-        || lease.version !== 1 || typeof lease.leaseId !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.leaseId)
-        || typeof lease.leaseSecret !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.leaseSecret)
-        || typeof lease.taskId !== 'string' || lease.taskId.length === 0
-        || typeof lease.controlGeneration !== 'string' || lease.controlGeneration.length === 0
-        || typeof lease.controllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.controllerInstanceDigest)
-        || !validProcess(lease.controllerProcess) || !validBuild(lease.buildIdentity)
-        || !Number.isSafeInteger(lease.issuedAt) || !Number.isSafeInteger(lease.expiresAt)
-        || lease.expiresAt <= lease.issuedAt) {
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller open result is invalid');
-    }
-    return result;
-}
-function requestController(params) {
-    const result = parseCodexControllerResult(requestSandboxAgentOperation({
-        agentClient: 'codex',
-        operation: `controller.${params.command}`,
-        payload: params.command === 'open'
-            ? { controllerProcess: params.controllerProcess }
-            : { proof: params.controllerProof },
-        ...params
-    }));
-    if (result.status === 'opened'
-        && (result.lease.controlGeneration !== (params.generation ?? process.env.AGENT_INFRA_CONTROL_GENERATION)
-            || result.lease.controllerProcess.pid !== params.controllerProcess.pid
-            || result.lease.controllerProcess.startTime !== params.controllerProcess.startTime)) {
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller result does not match the request');
-    }
-    return result;
-}
-function requestCodexControllerOpen(params) {
-    const result = requestController({ ...params, command: 'open', controllerProof: null });
-    if (result.status !== 'opened')
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller open returned the wrong result');
-    return result;
-}
-function requestCodexControllerClose(params) {
-    const result = requestController({ ...params, command: 'close' });
-    if (result.status !== 'closed')
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller close returned the wrong result');
-    return result;
-}
-function requestCodexControllerVerify(params) {
-    const result = requestController({ ...params, controllerProcess: params.controllerProof.controllerProcess, command: 'verify' });
-    if (result.status !== 'verified')
-        fail('SANDBOX_CONTROL_RESULT_INVALID', 'controller verify returned the wrong result');
-    return result;
-}
-export { parseCodexControllerResult, requestCodexControllerClose, requestCodexControllerOpen, requestCodexControllerVerify };
-//# sourceMappingURL=controller-client.js.map